CVE-2024-44314: Medium severity tastyigniter vulnerability
TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the indexonUpdateStatus() function within Orders.php, which fails to verify if the user has permission to modify an order's status. This flaw can be exploited remotely, leading to unauthorized order manipulation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-44314?
CVE-2024-44314 has been classified with a medium severity level due to its potential impact on unauthorized access to order management.
How do I fix CVE-2024-44314?
To mitigate CVE-2024-44314, ensure that proper access control validations are implemented in the index_onUpdateStatus() function of Orders.php.
Who is affected by CVE-2024-44314?
CVE-2024-44314 affects users of TastyIgniter version 3.7.6 that utilize the Orders Management System.
What impact does CVE-2024-44314 have?
CVE-2024-44314 allows unauthorized users to update order statuses, potentially leading to data integrity issues in order management.
When was CVE-2024-44314 discovered?
CVE-2024-44314 was published in 2024, highlighting a significant access control flaw in TastyIgniter.